ServiceNow CIS-HR free question 8 / 10 · Domain 3: Describe and Use Platform, Role, and Contextual Security
An administrator creates a record ACL on a parent table that several HR tables extend. According to ACL rule types, which tables does the rule apply to?
- The parent table and tables in the same application scope
- The parent table and any table that extends it
- Only the parent table, until the rule is copied to each child
- Only the child tables, as the parent is protected by default
Show the answer and explanation
Answer: B
Why this is correct
Record ACL rules consist of table and field names. The table name is the table that you want to secure; if other tables extend from it, it is considered a parent table, and ACL rules for parent tables apply to any table that extends the parent table. The same applies to fields: some fields are part of multiple tables because of table extension, and ACL rules for fields in a parent table apply to any table that extends the parent table. A rule written once on a parent therefore protects every extending table, which matters in HR, where many case tables extend a common parent.
Why the other options are wrong
"Only the parent table, until the rule is copied to each child" … No copying is needed. The page says ACL rules for parent tables apply to any table that extends the parent table.
"Only the child tables, as the parent is protected by default" … The rule covers the parent table it names as well as the tables that extend it.
"The parent table and tables in the same application scope" … The page ties the reach of the rule to table extension, not to application scope: rules for parent tables apply to any table that extends the parent.
Order of record rules
Record ACL rules are processed by matching the object against table ACL rules and then against field ACL rules, and a user must pass both table and field ACL rules to access a record object.
Go to the ServiceNow CIS-HR practice app (10 free questions; purchase unlocks all questions)